Guard-rails & control

Traceability, approvals and a kill switch are a precondition for adoption. Observability is not an add-on but a precondition.

Enforced centrally, fail-closed

Hard limits are not left to the agent prompt (a prompt can be bypassed or injected), but defined centrally and enforced outside the runtime. When in doubt, it blocks.

Enforcement points

• Secrets broker — which access, for how long, for which task
• Egress — where the sandbox may talk at all
• Tool layer — which actions are allowed and which need approval

Approvals (approval gates)

Critical actions wait for a human approval before they run. The human stays in the loop.

Recording, cost, kill switch

Every session is recorded — step by step, with cost. Anomalies raise alerts; in an emergency a kill switch stops the agent immediately.